The present invention relates to storage area networks. More particularly, it relates to detection of anomalies of the traffic for such storage area networks.
In recent years, the capacity of storage devices has not increased as fast as the demand for storage. Additionally, a host may wish to use multiple storage devices because it needs tiered and heterogeneous storage or because storage management facilities are needed for reasons specific to the storage environment. For example, it may be desirable to use database tables on a fast storage device, and other tables on a slower or less expensive storage device.
In order to solve these storage limitations, the storage area network (SAN) was developed. Generally, a storage area network is a high-speed special-purpose network that interconnects different data storage devices and associated data hosts on behalf of a larger network of users.
Protection of network storage resources in a data center is of paramount importance. Today this has become mandatory not only because of the rise of network based attacks but also due to changes in various regulatory environments. For example, Sarbanes-Oxley and HIPPA (HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT) regulations mandate that the data center provider must implement robust mechanisms to detect any anomalous behavior in the network.
In large server farms, grid computing and server virtualization have become state of the art. In these types of systems, multiple servers or hosts typically share the same data. It is extremely important to protect the critical storage resource from a single compromised host without impacting the entire server farm. For example, consider a scenario where all the servers in a grid have been authorized access to storage resource. In this scenario a single compromised server is able to corrupt the shared storage meta data and, thereby, cause the entire grid to fail. Current mechanisms in SAN security do not detect such anomalous behavior.
In the above setup the compromised server can also result in a Denial of Service (DOS) attack by causing excessive access to shared storage resource, thereby, degrading the availability of resources to other non-compromised hosts in the grid. Traditional SAN security techniques such as hard zoning, LUN zoning, read-only zoning, etc. cannot prevent or detect such anomaly. Note that the compromised host has been authorized access to the storage resource because it is a trusted host and this trusted host then proceeds to take malicious actions. For example, a compromised host may take the form of a malicious host, an infected host, or a host with an application software bug that can corrupt user data.
Another type of anomaly could arise due to changes in traffic that affect a storage network's configuration. In many cases, storage networks are configured for optimal performance based on usage pattern. For example, stripe unit size is configured based on predominant IO size (or size of each data write) of the traffic. Any deviation from this IO size could lead to significant performance degradation. Such deviation may happen due to a misconfiguration or change in the software application using the storage resource. Detection of such misconfiguration or change is extremely valuable in a data-center.
Accordingly, it would be beneficial to provide anomaly detection for storage traffic. Additionally, mechanisms for managing detected anomalies so as to minimize deleterious effects caused by such anomalies would also be beneficial.